Is there a size limit on signatures in Java (java.security)?

Question

I am trying to sign a token using SHA1. I use bouncycastle as a security provider. Whenever a program tries to sign something, it gives me this error.

java.security.SignatureException: java.lang.IllegalArgumentException: input data too large. 

What is the maximum size for a signature? Do you have any suggestions on how I can sign this object?

Answer 1

The input size is limited by the key size. If you use a 1024-bit key, you are limited to 128 bytes.

Usually you sign a digest (hash value), not actual data.

Answer 2

To fix this error, you just need to use a larger key size. For example, if the SHA 512 bit is selected, the key may be 1024 bits. But you will work with a key of the same (512) or shorter length.

BouncyCastle just gives us an unacceptable error message. But std lib is doing its job right. Compare them:

 // using a 512 bit key here // leads to this error message if Sun standard provider is used Signature sig = Signature.getInstance("SHA512withRSA", "SunRsaSign"); rsa.initSign(privateKey); rsa.update(data); rsa.sign(); java.security.InvalidKeyException: Key is too short for this signature algorithm at sun.security.rsa.RSASignature.initCommon(RSASignature.java:129) at sun.security.rsa.RSASignature.engineInitSign(RSASignature.java:111) at sun.security.rsa.RSASignature.engineInitSign(RSASignature.java:101) at java.security.Signature$Delegate.engineInitSign(Signature.java:1127) at java.security.Signature.initSign(Signature.java:511) // using a 512 bit key here // leads to this error message if the BounceCastle provider is used Signature sig = Signature.getInstance("SHA512withRSA", "BC"); ... java.security.SignatureException: java.lang.IllegalArgumentException: input data too large at org.bouncycastle.jce.provider.JDKDigestSignature.engineSign(Unknown Source) at java.security.Signature$Delegate.engineSign(Signature.java:1160) at java.security.Signature.sign(Signature.java:553)